Files
agent-runtime-framework/tests/invariants/test_cp_docs_token_layer.py

57 lines
1.6 KiB
Python

"""cp-docs-token/v1 context: env-only step-docs layer (PLN-CLI-16, D-40, AU-59).
The per-step wfcd_ token and CA file are delivered by the dispatcher. The layer
sets the env contract and ships one context doc; no ESO mount, no init script,
and no reference to the cp-service-token layer.
"""
from __future__ import annotations
from pathlib import Path
import yaml
_LAYER = (
Path(__file__).resolve().parents[2] / "harnesses" / "contexts" / "cp-docs-token" / "v1"
)
def _doc() -> dict:
return yaml.safe_load((_LAYER / "harness.yaml").read_text())
def test_cp_docs_token_layer_parses_with_env_keys():
doc = _doc()
assert doc["kind"] == "context"
assert doc["name"] == "cp-docs-token"
assert doc["version"] == 1
assert doc["requires"] == []
assert doc["provides"] == ["cp-docs-token"]
assert doc["env"] == {
"CP_DOCS_TOKEN_FILE": "/run/agent/cp-docs/token",
"CP_DOCS_CA_FILE": "/run/agent/cp-docs/ca.crt",
}
def test_cp_docs_token_layer_declares_no_secrets_and_no_init():
doc = _doc()
assert not doc.get("secrets_required")
assert not doc.get("scripts")
assert not (_LAYER / "init.sh").exists()
def test_cp_docs_token_layer_context_file_mapping():
doc = _doc()
assert doc["context_files"] == [
{
"source": "./CLAUDE.md",
"target": "/opt/harness/context/cp-docs-token/CLAUDE.md",
}
]
assert (_LAYER / "CLAUDE.md").is_file()
def test_cp_docs_token_layer_never_mentions_cp_service_token():
for path in _LAYER.rglob("*"):
if path.is_file():
assert "cp-service-token" not in path.read_text(), path